Though there's no explicit support (as far as I can tell) for
firewalls in ange-ftp mode, through a little trickery it's possible to
make it work through a particular kind of proxy.

If the proxy in question asks you to give your login name as
user@host.you.really.want
, you can trick ange-ftp into sending this as your username.

Note that simply opening
/realuser@real.host.com@proxy.address.com:file won't
work, probably because ange-ftp interprets this as a login of
realuser at the unresolvable hostname
real.host.com@proxy.address.com. Probably the code could
be changed (bugfixed?) to interpret this in the more useful way; I
don't know enough Emacs Lisp yet to do it.

Here's the workaround. First load ange-ftp (Most easily done by
trying to open a /user@host:file style path and then
cancelling), then do M-x ange-ftp-set-user RET. For host,
enter the address of your proxy. Enter
realuser@real.host.com for the user. Now you can open files at that host like so:

C-x C-f /@proxy.address:file

The only drawback (besides the annoying setup each time) is that
you can only have an ange-ftp session open like this to one host at a
time (since it associates the username with the proxy's address, not
the real remote host's).